Overview
overview
3Static
static
3ExLoader_I...er.exe
windows10-2004-x64
1ExLoader_I...er.exe
windows11-ltsc_2024-x64
1audioplaye...in.dll
windows10-2004-x64
1audioplaye...in.dll
windows11-ltsc_2024-x64
1data/app.so
ubuntu-18.04-amd64
1flutter_windows.dll
windows10-2004-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-ltsc_2024-x64
1permission...in.dll
windows10-2004-x64
1permission...in.dll
windows11-ltsc_2024-x64
1url_launch...in.dll
windows10-2004-x64
1url_launch...in.dll
windows11-ltsc_2024-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
ExLoader_Installer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
ExLoader_Installer.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral3
Sample
audioplayers_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
audioplayers_windows_plugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
data/app.so
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
flutter_windows.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
msvcp140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
msvcp140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
permission_handler_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
permission_handler_windows_plugin.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
url_launcher_windows_plugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
url_launcher_windows_plugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
vcruntime140_1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260709-en
General
- Target ExLoader_Installer.exe
- Size 173KB
- Sample260811-ffepvace53
- SHA256 93006384d339208d7125662bd928722cb3d1ac08855d46fe4fa2d6579e1260f1
- MD5 0572dd0c0fd63a372a10f14f5f981c59
- SHA1 d675b7d16da8f61cf5a219451d9286445ceb1343
- SHA512 bfc178a50e3560e0b672a935281501e18b8b6c71ac0a69d2a23706ee8614081f83d586d3e7887e7f2b3cd03f3ccd06472b5edd07a258cb843d09efe56e82eed9
- SSDEEP 3072:zfOnmYGioVzt/JUaD9QQfppuBsmx7Ho5T5VJdxJ0BwJ42o5oSMgbwUs5:zfOnaioVBxUaD9QWj5T5LL/J4Z5o
- TLSH T137048E11AB68C499F2F69AB4D9338905CD72FC961B34D6CF23912DAE09757E09E39303
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2124 ExLoader_Installer.exe 2124 ExLoader_Installer.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\network_fallback\weather_now.json
- Size 38KB
- SHA256 2bbbb5cf92a1d6e661b2720ec0683b7abfb148dde3d21cff699f5dcc45b1baae
- MD5 36f7a271a213b5e75d92cab70e7ccd40
- SHA1 d436827ece9c56cfc8fcf83e0d5b508edf2d06f7
- SHA512 d2f628ab2187a5601c5894c21baa6febcc96b8eb51152596e0bbb8e8d9f4566d678a23f1226730e61b015f6c7fd8f3233a58d221a86e96dfddd5825d9ad3f661
- SSDEEP 384:GXvG1rVC6qSSLruSGxgrjP0CrT3nyWyNg6i:G/G9VC6qSSL6SGxgrjPDrT3ryNg6i
- TLSH T1BE033720E231CD67611923BB2869306615858A2FCEC43E4A778DCD0C9F8DA5F67F5E2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
- Size 144B
- SHA256 eb9f0a23aeff3d84eb83bae406b12dd2c917de8e70e8b5d56a7856c06fbaec29
- MD5 500defdb840f20d8909055426a749789
- SHA1 7e2e9a4bd3c9d2a1e152eb01c83a3c1301c70ae3
- SHA512 08f3cb35f8136548e09e2504f7522ab8947f30dd52d68f68b0ada38f5d960ea1e0eb214e334dfff43dd1f4537e6a0ae44c40814c6f804172d287bb5a36cbf134
- TLSH T169C04CCA8B8401D13D91CE45157DB5F4A5605905D483044A0929459D874361FFBEFD12
- MD5 SHA1 SHA512 TLSH